Re: Michael looking for Old guy!

On Wed, 21 Dec 2005, in the Usenet newsgroup comp.security.misc, in article
<43a8fc0d$1_3@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>, McGlen wrote:

>I have tried to reply in the group. I was merely unable to find the the
>article on as you said in the newsgroup.

Well, on

Message-ID: <1135111405.625769.101160@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Newsgroups: comp.security.misc,alt.security,alt.hacker
Subject: Re: Attacker motivation
Date: 20 Dec 2005 12:43:25 -0800
From: laakso@xxxxxxxxxxxxx

and

Message-ID: <43a86c0b$1_1@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Newsgroups: comp.security.misc
Subject: Re: Michael looking for Old guy!
Date: Tue, 20 Dec 2005 20:37:57 -0000
From: "McGlen" <noreply@xxxxxxxxxxxxx>

and

Message-ID: <1135111814.679737.295930@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Newsgroups: alt.os.linux
Subject: Re: PCI USR 0778 dialup modem
Date: 20 Dec 2005 12:50:14 -0800
From: laakso@xxxxxxxxxxxxx

You manage to quote (poorly) from the original article. And two of the
three postings are from google.groups that has got the article archived.
Here's your original spam:

Message-ID: <1134158353.233486.21410@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Newsgroups: comp.security.misc
Subject: Are you worried about Spy-/Adware remove them for free
Date: 9 Dec 2005 11:59:13 -0800
From: "iii-online" <info@xxxxxxxxxxxxxxxx>

and my response to your advertisement:

Message-Id: <slrndpm614.o2r.ibuprofin@xxxxxxxxxxxxxxxxx>
Newsgroups: comp.security.misc
Subject: Re: Are you worried about Spy-/Adware remove them for free
Date: Sat, 10 Dec 2005 12:02:14 -0600
From: ibuprofin@xxxxxxxxxxxxxxxxxxxxxx (Moe Trin)

But allow me to respond to your comments:

>Your arithmetic skills are at least as good as your investigation skills!

Yes - it's a common skill called "follow the money"

>Why would
>I throw away any domain? The price for the domain is freely awailable if you
>go
>into it http://www.spywarejab.co.uk ! The price of hosting service is also
>freely
>available at http://order.1and1.co.uk ! I do not know about you, but my
>money
>is called salary and it comes from my employer into my pocket.

So, you are saying that the registration data is false?

[compton ~]$ whois -h whois.nic.uk spywarejab.co.uk

Domain Name:
spywarejab.co.uk

Registrant:
Michael Laakso

Registrant's Address:

THE REGISTRANT IS AN INDIVIDUAL WHO HAS ELECTED TO
HAVE THEIR ADDRESS OMITTED FROM THE WHOIS DATABASE

Registrant's Agent:
Schlund + Partner AG [Tag = SCHLUND]

Relevant Dates:
Registered on: 05-Dec-2005

"Registrant: Michael Laakso" and "THE REGISTRANT IS AN INDIVIDUAL" does
not look like "my employer". Who is this "employer", and why are they not
the registered site owner, and why aren't they posting under their own
name? Could that be Ashantiplc Limited that "claims" to be in Hong Kong,
but sitehosts in Vancouver, BC, and Houston TX? Would it have anything to
do with past abuse at google (never mind the rest of the Internet)?

Also, the fact that your advertisement is off charter for this newsgroup
isn't helping you. Don't know what is in the charter? Why certainly -
start at google that you so incompetently try to use, and search for
RFC1855 and RFC3098

1855 Netiquette Guidelines. S. Hambridge. October 1995. (Format:
TXT=46185 bytes) (Also FYI0028) (Status: INFORMATIONAL)

3098 How to Advertise Responsibly Using E-Mail and Newsgroups or - how
NOT to $$$$$ MAKE ENEMIES FAST! $$$$$. T. Gavin, D. Eastlake 3rd, S.
Hambridge. April 2001. (Format: TXT=64687 bytes) (Also FYI0038)
(Status: INFORMATIONAL)

Then use that same search engine to locate the charter, and the FAQ.

Frank mentions your address morphing:

From: "iii-online" <info@xxxxxxxxxxxxxxxx>
From: laakso@xxxxxxxxxxxxx
From: "McGlen" <noreply@xxxxxxxxxxxxx>

You're really shooting yourself in the foot without my help. I'm merely
pointing it out to everyone. That you advertised your site only four days
after submitting the registration is a big clue - as is your choice of
provider. Don't know what that means? Try news.admin.net-abuse.* which
you can also find archived at google. You are acting like a ROKSO spammer,
so why should you expect to be treated any differently.

You moan about not being able to contact me (it took you ten days to
respond to the posting), and yet you are morphing and using an invalid
address. The reason I don't post my real addresses is simple - every
time I do, they get harvested by spammers. That's also why I no longer
bother mailing to abuse addresses. Neither Tiscali or Schlund actually
do anything useful with complaints - which is why they're blocked at
every network I have control over. None of my users complain about
not being able to connect to the spam side of the Internet, so the blocks
will stay in place.

Old guy
.

Relevant Pages

  • Re: About Films
    ... USENET existed before Google came along. ... Google is just one of those servers. ... Newsgroup charters are put to a vote, ... Once the charter is created, ...
    (uk.rec.radio.cb)
  • Re: CHARTER of alt.cellular.cingular
    ... I think I thought I saw this post from John Navas ... Those ranting about the charter and alleged ... the procedures and of the history of this newsgroup. ... Google isn't a good way to find newsgroup charters. ...
    (alt.cellular.cingular)
  • Re: CHARTER of alt.cellular.cingular
    ... charter in the alt.cellular.attws newsgroup. ... Complaint sent to Google. ...
    (alt.cellular.cingular)
  • Charter for uk.media.newspapers
    ... This is the initial charter for the newsgroup uk.media.newspapers ... posting must begin with the word "ADVERT". ... and such advertisements may not exceed twenty lines. ...
    (uk.media.newspapers)
  • Charter for uk.media.newspapers
    ... This is the initial charter for the newsgroup uk.media.newspapers ... posting must begin with the word "ADVERT". ... and such advertisements may not exceed twenty lines. ...
    (uk.media.newspapers)